PT-2018-13961 · Videolan · Libmp4V2

Ace Team + 1 · Publicado 2018-09-20 · Atualizado 2023-04-11 · CVE-2018-17236

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libmp4v2 version 2.1.0

Description The issue arises from the function MP4Free() in mp4property.cpp, which internally calls free() on an invalid pointer. This results in a SIGABRT signal being raised.

Recommendations For libmp4v2 version 2.1.0, consider disabling the MP4Free() function as a temporary workaround until a patch is available.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2018-17236

Produtos afetados

Libmp4V2

Referências · 7

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1629453 · Exploit
• https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0 · Nota
• https://cve.org/CVERecord?id=CVE-2018-17236 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17236 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17236 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17236 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17236 · Nota de Segurança